Skip to content

Least Privilege

What is Least Privilege?

The security principle of granting users only the minimum access rights needed to perform their job functions. Reduces the attack surface and limits damage from compromised accounts.

Information Security

Related terms

Access ControlRBAC (Role-Based Access Control)Zero Trust

Frameworks that govern least privilege

ISO 27001:2022View framework →NIST SP 800-53 Rev 5View framework →

What the standards actually require on least privilege

Requirements naming least privilege across 6 standards, quoted from the control text.

NIST SP 800-53 Rev 510 controls

Provide separate processing domains to enable finer-grained allocation of user privileges.

NIST800-AC-6(4) · AC-6(4) Least Privilege | Separate Processing Domains →
IEC 624437 controls

The asset owner shall grant users the least privilege needed for their role, on IACS components and the applications on them.

iec-62443::USER 1.5 · Least privilege →
NIST SP 800-53 Rev 5 HIGH6 controls

Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].

nist-sp-800-53-revision-5-1-high::AC-6(5) · AC-6(5) Least Privilege | Privileged Accounts →
AWS Well-Architected Security Pillar5 controls

Write IAM policies that allow only the specific actions, resources and conditions a job needs, starting broad and narrowing them, with policy generation in IAM Access Analyzer as one aid to the narrowing. Record exceptions.

SEC03-BP02 · Grant least privilege access →
FBI CJIS Security Policy5 controls

Apply least privilege, allowing users and the processes acting for them only the accesses necessary to accomplish their assigned tasks.

fbi-cjis-security-policy::AC-6 · AC-6 Least Privilege →
NIST SP 800-53 Rev 5 MODERATE5 controls

Restrict privileged accounts on the system to [Assignment: organization-defined personnel or roles].

nist-sp-800-53-rev-5-moderate::AC-6(5) · AC-6(5) Least Privilege | Privileged Accounts →

Questions people ask about least privilege

What is Least Privilege?
The security principle of granting users only the minimum access rights needed to perform their job functions. Reduces the attack surface and limits damage from compromised accounts.
Why is Least Privilege important for compliance?
Least Privilege is a key concept in Information Security. Understanding least privilege helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to Least Privilege?
Key concepts related to Least Privilege include Access Control, RBAC (Role-Based Access Control), Zero Trust. Understanding these interconnected concepts provides a more comprehensive view of Information Security requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address Least Privilege?
Least Privilege appears in the requirement text of NIST SP 800-53 Rev 5, IEC 62443, NIST SP 800-53 Rev 5 HIGH, AWS Well-Architected Security Pillar, FBI CJIS Security Policy. Across these standards we have identified 38 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about Least Privilege?
Explore our compliance framework pages to see how least privilege applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how Least Privilege applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.